Back

Koi Research
Security Insights

Live Updates: Shai-Hulud, The Most Dangerous NPM Breach In History Affecting CrowdStrike and Hundreds of Popular Packages

Idan Dardikman

,

Yuval Ronen

,

September 16, 2025

We are tracking the largest and most dangerous npm supply-chain compromise in history, known as the Shai-Hulud malware campaign, which has now impacted hundreds of packages across multiple maintainers. This includes popular libraries such as @ctrl/tinycolor as well as packages maintained by CrowdStrike. Malicious versions embed a trojanized script (bundle.js) designed to steal developer credentials, exfiltrate secrets, and persist in repositories and endpoints through automated workflows. The table below is continuously updated in real time as additional compromised packages are identified.

Subscribe for live updates

hubspot-form

What Happened?

Attackers published malicious versions of @ctrl/tinycolor and other npm packages, injecting a large obfuscated script (bundle.js) that executes automatically during installation. This payload repackages and republishes maintainer projects, enabling the malware to spread laterally across related packages without direct developer involvement. As a result, the compromise quickly scaled beyond its initial entry point, impacting not only widely used open-source libraries but also CrowdStrike’s npm packages.

The injected script performs credential harvesting and persistence operations. It runs TruffleHog to scan local filesystems and repositories for secrets, including npm tokens, GitHub credentials, and cloud access keys for AWS, GCP, and Azure. It also writes a hidden GitHub Actions workflow file (.github/workflows/shai-hulud-workflow.yml) that exfiltrates secrets during CI/CD runs, ensuring long-term access even after the initial infection. This dual focus on endpoint secret theft and backdoors makes Shai-Hulud one of the most dangerous campaigns ever compared to previous compromises.

What to Do?

Organizations should act quickly to contain the impact of the Shai-Hulud campaign.

  • Begin by scanning across all endpoints - developer machines, build servers, and CI/CD agents - for the presence of impacted packages (Koi customers already got alerts for relevant packages)
  • Any compromised versions should be removed immediately, and we recommend temporarily freezing npm package updates until the full scope of the attack is understood (Koi customers are protected via network guardrails)
  • Next, perform a complete credential rotation, including GitHub, npm, AWS, GCP, and Azure tokens, since the malware is designed to harvest secrets from multiple environments
  • Finally, audit your repositories for persistence mechanisms by reviewing .github/workflows/ for suspicious files such as shai-hulud-workflow.yml or unexpected branches

These steps will help reduce risk and limit attacker footholds while the investigation and cleanup continue.

Need Help?

Concerned your organization may be affected? Reach out to us for expert guidance on detecting compromised packages and mitigating this supply-chain attack.

IOCs

https://webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7

78e701f42b76ccde3f2678e548886860 [MD5] - bundle.js

fbf3fe241abf21b1a732352a037edec0 [MD5] - bundle.js

Confirmed Compromised Packages (Live Updates)

Compromised Packages Table
Package Name Compromised Version(s) Detection Date Status
react-complaint-image0.0.352025-09-16Removed from NPM
encounter-playground0.0.52025-09-16Removed from NPM
rxnt-authentication0.0.62025-09-16Removed from NPM
@nativescript-community/ui-drawer0.1.302025-09-16Removed from NPM
json-rules-engine-simplified0.2.12025-09-16Removed from NPM
react-jsonschema-form-conditionals0.2.42025-09-16Removed from NPM
react-jsonschema-form-extras0.3.212025-09-16Removed from NPM
rxnt-healthchecks-nestjs1.0.42025-09-16Removed from NPM
rxnt-kue1.0.52025-09-16Removed from NPM
@ctrl/golang-template1.0.72025-09-16Removed from NPM
@nativescript-community/text1.4.32025-09-16Removed from NPM
swc-plugin-component-annotate1.6.132025-09-16Removed from NPM
ngx-color1.9.22025-09-16Removed from NPM
angulartics210.0.22025-09-16Removed from NPM
ngx-toastr14.1.22025-09-16Removed from NPM
@ctrl/react-adsense19.0.22025-09-16Removed from NPM
@nativescript-community/gesturehandler2.0.22025-09-16Removed from NPM
ts-gaussian2.0.352025-09-16Removed from NPM
@ctrl/ngx-rightclick3.0.62025-09-16Removed from NPM
@ctrl/ts-base324.0.22025-09-16Removed from NPM
@ctrl/magnet-link4.0.22025-09-16Removed from NPM
@ctrl/tinycolor4.0.42025-09-16Removed from NPM
@ctrl/torrent-file4.1.12025-09-16Removed from NPM
@nativescript-community/ui-image4.1.22025-09-16Removed from NPM
@nativescript-community/sentry4.1.22025-09-16Removed from NPM
koa2-swagger-ui4.5.62025-09-16Removed from NPM
@ctrl/ngx-csv4.6.432025-09-16Removed from NPM
@nativescript-community/ui-collectionview5.11.12025-09-16Removed from NPM
@ctrl/shared-torrent5.11.22025-09-16Removed from NPM
@ctrl/ngx-codemirror6.0.22025-09-16Removed from NPM
@ctrl/deluge6.0.62025-09-16Removed from NPM
@nativescript-community/ui-material-bottomsheet6.3.22025-09-16Removed from NPM
@nativescript-community/ui-material-core7.0.22025-09-16Removed from NPM
@nativescript-community/ui-material-core-tabs7.2.22025-09-16Removed from NPM
@ctrl/transmission7.2.722025-09-16Removed from NPM
ngx-trend7.2.762025-09-16Removed from NPM
@ctrl/ngx-emoji-mart7.2.762025-09-16Removed from NPM
@ctrl/qbittorrent7.3.12025-09-16Removed from NPM
@ahmedhfarag/ngx-perfect-scrollbar8.0.1, 20.0.202025-09-16Removed from NPM
@ahmedhfarag/ngx-virtual-scroller4.0.4, 9.2.22025-09-16Removed from NPM
@art-ws/common9.7.22025-09-16Removed from NPM
@art-ws/config-eslint2.0.4, 2.0.52025-09-16⚠️ Active
@art-ws/config-ts2.0.7, 2.0.82025-09-16⚠️ Active
@art-ws/db-context2.0.242025-09-16⚠️ Active
@art-ws/di2.0.28, 2.0.322025-09-16⚠️ Active
@art-ws/di-node2.0.132025-09-16⚠️ Active
@art-ws/eslint1.0.5, 1.0.62025-09-16⚠️ Active
@art-ws/fastify-http-server2.0.24, 2.0.272025-09-16⚠️ Active
@art-ws/http-server2.0.21, 2.0.252025-09-16⚠️ Active
@art-ws/openapi0.1.9, 0.1.122025-09-16⚠️ Active
@art-ws/package-base1.0.5, 1.0.62025-09-16⚠️ Active
@art-ws/prettier1.0.5, 1.0.62025-09-16⚠️ Active
@art-ws/slf2.0.15, 2.0.222025-09-16⚠️ Active
@art-ws/ssl-info1.0.9, 1.0.102025-09-16⚠️ Active
@art-ws/web-app1.0.3, 1.0.42025-09-16⚠️ Active
@crowdstrike/commitlint8.1.1, 8.1.22025-09-16Removed from NPM
@crowdstrike/falcon-shoelace0.4.1, 0.4.22025-09-16Removed from NPM
@crowdstrike/foundry-js0.19.1, 0.19.22025-09-16Removed from NPM
@crowdstrike/glide-core0.34.2, 0.34.32025-09-16Removed from NPM
@crowdstrike/logscale-dashboard1.205.1, 1.205.22025-09-16Removed from NPM
@crowdstrike/logscale-file-editor1.205.1, 1.205.22025-09-16Removed from NPM
@crowdstrike/logscale-parser-edit1.205.1, 1.205.22025-09-16Removed from NPM
@crowdstrike/logscale-search1.205.1, 1.205.22025-09-16Removed from NPM
@crowdstrike/tailwind-toucan-base5.0.1, 5.0.22025-09-16Removed from NPM
@hestjs/core0.2.12025-09-16⚠️ Active
@hestjs/cqrs0.1.62025-09-16⚠️ Active
@hestjs/demo0.1.22025-09-16⚠️ Active
@hestjs/eslint-config0.1.22025-09-16⚠️ Active
@hestjs/logger0.1.62025-09-16⚠️ Active
@hestjs/scalar0.1.72025-09-16⚠️ Active
@hestjs/validation0.1.62025-09-16⚠️ Active
@nativescript-community/arraybuffers1.1.6, 1.1.7, 1.1.82025-09-16Removed from NPM
@nativescript-community/perms3.0.5, 3.0.6, 3.0.7, 3.0.82025-09-16Removed from NPM
@nativescript-community/sqlite3.5.2, 3.5.3, 3.5.4, 3.5.52025-09-16Removed from NPM
@nativescript-community/typeorm0.2.30, 0.2.31, 0.2.32, 0.2.332025-09-16Removed from NPM
@nativescript-community/ui-document-picker6.0.62025-09-16Removed from NPM
@nativescript-community/ui-label1.3.35, 1.3.36, 1.3.372025-09-16Removed from NPM
@nativescript-community/ui-material-bottom-navigation7.2.72, 7.2.73, 7.2.74, 7.2.752025-09-16Removed from NPM
@nativescript-community/ui-material-ripple7.2.72, 7.2.73, 7.2.74, 7.2.752025-09-16Removed from NPM
@nativescript-community/ui-material-tabs7.2.72, 7.2.73, 7.2.74, 7.2.752025-09-16Removed from NPM
@nativescript-community/ui-pager14.1.36, 14.1.37, 14.1.382025-09-16Removed from NPM
@nativescript-community/ui-pulltorefresh2.5.4, 2.5.5, 2.5.6, 2.5.72025-09-16Removed from NPM
@nexe/config-manager0.1.12025-09-16⚠️ Active
@nexe/eslint-config0.1.12025-09-16⚠️ Active
@nexe/logger0.1.32025-09-16⚠️ Active
@nstudio/angular20.0.4, 20.0.5, 20.0.62025-09-16Removed from NPM
@nstudio/focus20.0.4, 20.0.5, 20.0.62025-09-16Removed from NPM
@nstudio/nativescript-checkbox2.0.6, 2.0.7, 2.0.8, 2.0.92025-09-16Removed from NPM
@nstudio/nativescript-loading-indicator5.0.1, 5.0.2, 5.0.3, 5.0.42025-09-16Removed from NPM
@nstudio/ui-collectionview5.1.11, 5.1.12, 5.1.13, 5.1.142025-09-16Removed from NPM
@nstudio/web20.0.42025-09-16Removed from NPM
@nstudio/web-angular20.0.42025-09-16Removed from NPM
@nstudio/xplat20.0.5, 20.0.6, 20.0.72025-09-16Removed from NPM
@nstudio/xplat-utils20.0.5, 20.0.6, 20.0.72025-09-16Removed from NPM
@operato/board9.0.512025-09-16⚠️ Active
@operato/data-grist9.0.29, 9.0.35, 9.0.36, 9.0.372025-09-16⚠️ Active
@operato/graphql9.0.512025-09-16⚠️ Active
@operato/headroom9.0.2, 9.0.35, 9.0.36, 9.0.372025-09-16⚠️ Active
@operato/help9.0.512025-09-16⚠️ Active
@operato/i18n9.0.35, 9.0.36, 9.0.372025-09-16⚠️ Active
@operato/input9.0.482025-09-16⚠️ Active
@operato/layout9.0.35, 9.0.36, 9.0.372025-09-16⚠️ Active
@operato/popup9.0.22, 9.0.35, 9.0.36, 9.0.37, 9.0.38, 9.0.39, 9.0.40, 9.0.41, 9.0.42, 9.0.43, 9.0.44, 9.0.45, 9.0.462025-09-16⚠️ Active
@operato/pull-to-refresh9.0.472025-09-16⚠️ Active
@operato/shell9.0.22, 9.0.35, 9.0.36, 9.0.37, 9.0.38, 9.0.392025-09-16⚠️ Active
@operato/styles9.0.2, 9.0.35, 9.0.36, 9.0.372025-09-16⚠️ Active
@operato/utils9.0.512025-09-16⚠️ Active
@teselagen/bounce-loader0.3.16, 0.3.172025-09-16Removed from NPM
@teselagen/liquibase-tools0.4.12025-09-16Removed from NPM
@teselagen/range-utils0.3.14, 0.3.152025-09-16Removed from NPM
@teselagen/react-list0.8.19, 0.8.202025-09-16Removed from NPM
@teselagen/react-table6.10.192025-09-16Removed from NPM
@thangved/callback-window1.1.42025-09-16⚠️ Active
@things-factory/attachment-base9.0.552025-09-16⚠️ Active
@things-factory/auth-base9.0.43, 9.0.44, 9.0.452025-09-16⚠️ Active
@things-factory/email-base9.0.592025-09-16⚠️ Active
@things-factory/env9.0.42, 9.0.43, 9.0.44, 9.0.452025-09-16⚠️ Active
@things-factory/integration-base9.0.43, 9.0.44, 9.0.452025-09-16⚠️ Active
@things-factory/integration-marketplace9.0.43, 9.0.44, 9.0.452025-09-16⚠️ Active
@things-factory/shell9.0.43, 9.0.44, 9.0.452025-09-16⚠️ Active
@tnf-dev/api1.0.82025-09-16⚠️ Active
@tnf-dev/core1.0.82025-09-16⚠️ Active
@tnf-dev/js1.0.82025-09-16⚠️ Active
@tnf-dev/mui1.0.82025-09-16⚠️ Active
@tnf-dev/react1.0.82025-09-16⚠️ Active
@ui-ux-gang/devextreme-angular-rpk24.1.72025-09-16⚠️ Active
@yoobic/design-system6.5.172025-09-16⚠️ Active
@yoobic/jpeg-camera-es61.0.132025-09-16⚠️ Active
@yoobic/yobi8.7.532025-09-16⚠️ Active
airchief0.3.12025-09-16⚠️ Active
airpilot0.8.82025-09-16⚠️ Active
browser-webdriver-downloader3.0.82025-09-16Removed from NPM
capacitor-notificationhandler0.0.32025-09-16⚠️ Active
capacitor-plugin-healthapp0.0.32025-09-16⚠️ Active
capacitor-plugin-ihealth1.1.92025-09-16⚠️ Active
capacitor-plugin-vonage1.0.32025-09-16⚠️ Active
capacitorandroidpermissions0.0.52025-09-16⚠️ Active
config-cordova0.8.52025-09-16⚠️ Active
cordova-plugin-voxeet21.0.242025-09-16Removed from NPM
cordova-voxeet1.0.322025-09-16⚠️ Active
create-hest-app0.1.92025-09-16⚠️ Active
db-evo1.1.52025-09-16⚠️ Active
devextreme-angular-rpk21.2.82025-09-16⚠️ Active
ember-browser-services5.0.2, 5.0.32025-09-16Removed from NPM
ember-headless-form1.1.2, 1.1.32025-09-16Removed from NPM
ember-headless-form-yup1.0.12025-09-16Removed from NPM
ember-headless-table2.1.5, 2.1.62025-09-16Removed from NPM
ember-url-hash-polyfill1.0.12, 1.0.132025-09-16Removed from NPM
ember-velcro2.2.1, 2.2.22025-09-16Removed from NPM
eslint-config-crowdstrike11.0.2, 11.0.32025-09-16Removed from NPM
eslint-config-crowdstrike-node4.0.3, 4.0.42025-09-16Removed from NPM
eslint-config-teselagen6.1.72025-09-16Removed from NPM
globalize-rpk1.7.42025-09-16⚠️ Active
graphql-sequelize-teselagen5.3.82025-09-16Removed from NPM
html-to-base64-image1.0.22025-09-16Removed from NPM
jumpgate0.0.22025-09-16⚠️ Active
mcfly-semantic-release1.3.12025-09-16⚠️ Active
mcp-knowledge-base0.0.22025-09-16Removed from NPM
mcp-knowledge-graph1.2.12025-09-16⚠️ Active
mobioffice-cli1.0.32025-09-16⚠️ Active
monorepo-next13.0.1, 13.0.22025-09-16Removed from NPM
mstate-angular0.4.42025-09-16⚠️ Active
mstate-cli0.4.72025-09-16⚠️ Active
mstate-dev-react1.1.12025-09-16⚠️ Active
mstate-react1.6.52025-09-16⚠️ Active
ng2-file-upload7.0.2, 7.0.3, 8.0.1, 8.0.2, 8.0.3, 9.0.12025-09-16Removed from NPM
ngx-bootstrap18.1.4, 19.0.3, 19.0.4, 20.0.3, 20.0.4, 20.0.52025-09-16Removed from NPM
ngx-ws1.1.62025-09-16⚠️ Active
oradm-to-gql35.0.14, 35.0.152025-09-16Removed from NPM
oradm-to-sqlz1.1.22025-09-16Removed from NPM
ove-auto-annotate0.0.92025-09-16Removed from NPM
pm2-gelf-json1.0.52025-09-16⚠️ Active
printjs-rpk1.6.12025-09-16⚠️ Active
remark-preset-lint-crowdstrike4.0.1, 4.0.22025-09-16Removed from NPM
tbssnch1.0.22025-09-16⚠️ Active
teselagen-interval-tree1.1.22025-09-16⚠️ Active
tg-client-query-builder2.14.4, 2.14.52025-09-16Removed from NPM
tg-redbird1.3.12025-09-16Removed from NPM
tg-seq-gen1.0.9, 1.0.102025-09-16Removed from NPM
thangved-react-grid1.0.32025-09-16Removed from NPM
ts-imports1.0.22025-09-16⚠️ Active
tvi-cli0.1.52025-09-16⚠️ Active
ve-bamreader0.2.62025-09-16Removed from NPM
ve-editor1.0.12025-09-16Removed from NPM
verror-extra6.0.12025-09-16Removed from NPM
voip-callkit1.0.32025-09-16⚠️ Active
wdio-web-reporter0.1.32025-09-16⚠️ Active
yargs-help-output5.0.32025-09-16Removed from NPM
yoo-styles6.0.3262025-09-16⚠️ Active
@basic-ui-components-stc/basic-ui-components1.0.52025-09-16⚠️ Active
@ui-ux-gang/devextreme-rpk24.1.72025-09-16⚠️ Active
ng-imports-checker0.0.102025-09-16⚠️ Active
ace-colorpicker-rpk0.0.142025-09-16⚠️ Active

Copied to clipboard

Be the first to know

Fresh research and updates on software risk and endpoint security.

related blogs

Koi Research

The Package Poisoner: How 2.5 Billion Weekly Downloads Were Compromised in npm's Largest Supply Chain Attack

Idan Dardikman

,

Yuval Ronen

,

September 8, 2025

Koi Research

WhiteCobra's Playbook Exposed: Critical Mistake Reveals 24-Extension Campaign Targeting VS Code and Cursor

Yuval Ronen

,

,

September 13, 2025

Koi Research

SpyVPN: The Google-Featured VPN That Secretly Captures Your Screen

Lotan Sery

,

,

August 19, 2025